ASIS InternationalASIS International53 53 rdrd Annual Seminar & ExhibitsAnnual Seminar & Exhibits

September 25, 2007

Dennis M. LormelSenior Vice President

Anti-Money LaunderingTerrorist Financing

Combating the Financing of TerrorCombating the Financing of Terror

Gregory T. BretzingSupervisory Special AgentJoint Terrorism Task Force

Salt Lake Division

AML / Terrorist FinancingAML / Terrorist Financing

••

IntroductionIntroduction

••

Understanding & Understanding & Disrupting Terrorist Disrupting Terrorist FinancingFinancing

••

Systemic Weaknesses Systemic Weaknesses Exploited by TerroristsExploited by Terrorists

••

Characteristics & Characteristics & TrendsTrends

••

Case StudyCase Study

••

ConclusionConclusion

IntroductionIntroduction

National Intelligence Estimate National Intelligence Estimate

••

Terrorist threat to U.S. Homeland (July 2007)Terrorist threat to U.S. Homeland (July 2007)––

U.S. Homeland will face persistent and evolving threat U.S. Homeland will face persistent and evolving threat over next three yearsover next three years••

Main threat Islamic terrorismMain threat Islamic terrorism

••

Al Qaeda most serious threatAl Qaeda most serious threat••

HizballahHizballah more likely to attack U.S. if perceives more likely to attack U.S. if perceives U.S. poses direct threat to itself or IranU.S. poses direct threat to itself or Iran

••

Spread of radical internet sites, increased anti Spread of radical internet sites, increased anti U.S. rhetoric and growing number of self U.S. rhetoric and growing number of self generating cells expandinggenerating cells expanding

––

To include U.S.To include U.S.

••

NonNon--Muslim terrorist groups Muslim terrorist groups ““single issuesingle issue”” groupsgroups

––

Probably will conduct attacksProbably will conduct attacks

Adam Gadahn aka Azzam the Adam Gadahn aka Azzam the AmericanAmerican••

American born AlAmerican born Al--Qaeda Qaeda spokesmanspokesman

••

Embraced Islam in midEmbraced Islam in mid--1990s and 1990s and moved to Pakistanmoved to Pakistan

••

Has appeared in Al Qaeda videos Has appeared in Al Qaeda videos since 2004 espousing jihad since 2004 espousing jihad against Americaagainst America

••

August 2007 videoAugust 2007 video––

““We shall continue to target you at We shall continue to target you at home and abroad just as you target home and abroad just as you target us at home and abroad...us at home and abroad...””

Four Main Categories of TerrorismFour Main Categories of Terrorism

••

As defined by the Combating As defined by the Combating Terrorism Center (CTC) at West PointTerrorism Center (CTC) at West Point––

Organizations that possess international Organizations that possess international infrastructure and global agendainfrastructure and global agenda

––

Domestic terrorist groups with national Domestic terrorist groups with national agendaagenda

––

Acts of terrorism carried out by Acts of terrorism carried out by individuals motivated by extremist individuals motivated by extremist ideologyideology••

Homegrown cellsHomegrown cells

––

Terrorism carried out by state Terrorism carried out by state sponsorshipsponsorship

Select Post 9/11 U.S. Terrorism CasesSelect Post 9/11 U.S. Terrorism Cases••

ZacariasZacarias

MoussaouiMoussaoui ••

Portland Seven Portland Seven ••

ElashiElashi BrothersBrothers

••

JosJoséé PadillaPadilla ••

Lackawanna SixLackawanna Six ••

InfocomInfocom

••

Abad Abad ElfgeehElfgeeh Carnival Ice CreamCarnival Ice Cream

••

Dhiren Barot aka Dhiren Barot aka IssaIssa

al Britanial Britani••

Holy Land Holy Land FoundationFoundation

••

AbdurahmanAbdurahman AlamoudiAlamoudi

••

Daniel Maldonado Daniel Maldonado aka aka AljughaifiAljughaifi

••

Benevolence Benevolence InternationalInternational

••

Ali al Ali al MarriMarri ••

HamadHamad

HayatHayat ••

Al Al HaramainHaramain

••

Sheik al Sheik al MoayadMoayad ••

UzairUzair ParachaParacha ••

NYC Subway PlotNYC Subway Plot

••

Adnan el ShukrijumahAdnan el Shukrijumah ••

MajidMajid

KhanKhan ••

NYC Tunnel PlotNYC Tunnel Plot

••

Adam GadahnAdam Gadahn ••

IymanIyman FarisFaris ••

Omar BrothersOmar Brothers

••

Sami al ArianSami al Arian ••

Babar AhmadBabar Ahmad ••

Miami GroupMiami Group

••

William KrarWilliam Krar ••

Hassan Hassan AbujihaadAbujihaad ••

Fort Dix PlotFort Dix Plot

••

Gale NettlesGale Nettles ••

NVA Paint Ball NVA Paint Ball GroupGroup

••

Goodwill Charitable Goodwill Charitable OrganizationOrganization

Terrorist GroupsTerrorist Groups……••

Are learning organizationsAre learning organizations––

Learn from their own history/experienceLearn from their own history/experience

––

Learn from experience of other groupsLearn from experience of other groups••

Knowledge and learning importantKnowledge and learning important

••

Assess their own vulnerabilitiesAssess their own vulnerabilities••

Adapt to exploit opportunitiesAdapt to exploit opportunities

Framework of Terrorist Attacks Framework of Terrorist Attacks ••

Terrorist attacks are the product of Terrorist attacks are the product of two primary elementstwo primary elements––

MotivationMotivation

IdeologyIdeologySocialSocialPoliticalPolitical

––

CapabilitiesCapabilitiesTrainingTrainingFinanceFinanceState sponsorshipState sponsorshipWeapons acquisitionWeapons acquisition

Terrorist Attack CycleTerrorist Attack Cycle

••

Target SelectionTarget Selection

••

PlanningPlanning

••

DeploymentDeployment

••

AttackAttack

••

EscapeEscape

••

ExploitationExploitation

Dhiren Barot aka Dhiren Barot aka IssaIssa al Britanial Britani••

Muslim convert and British citizenMuslim convert and British citizen

••

Al Qaeda operativeAl Qaeda operative––

Trained in terror campsTrained in terror camps••

Sent to U.S. (pre 9/11) to Sent to U.S. (pre 9/11) to surveilsurveil potential potential terror targets to includeterror targets to include––

International Monetary FundInternational Monetary Fund––

World BankWorld Bank––

New York Stock ExchangeNew York Stock Exchange––

Citigroup CenterCitigroup Center––

Prudential BuildingPrudential Building••

Evidence discovered on computer of Evidence discovered on computer of Mohammed Mohammed NaeemNaeem NoorNoor Khan and via Khan and via interrogations of captures al Qaeda leaderinterrogations of captures al Qaeda leader

••

Planned attacks in Britain & U.S.Planned attacks in Britain & U.S.––

Made detailed proposal to al Qaeda financers Made detailed proposal to al Qaeda financers in Pakistanin Pakistan

••

Indicted in U.S.Indicted in U.S.

••

Convicted in Britain (40 year sentence)Convicted in Britain (40 year sentence)––

Plot to blow up subway train and limousinesPlot to blow up subway train and limousines

Select Major Terrorist AttacksSelect Major Terrorist Attacks••

New York / Washington: New York / Washington: 9/11/20019/11/2001––

AlAl--QaedaQaeda––

World Trade Center / World Trade Center / PentagonPentagon

––

Jet airplanesJet airplanes––

Totally funded by AlTotally funded by Al--QaedaQaeda

••

Madrid: 3/11/2004Madrid: 3/11/2004––

Moroccan Islamic Moroccan Islamic Combatant Group (GICM)Combatant Group (GICM)

––

TrainsTrains––

Bombs in backpacks / Bombs in backpacks / luggage left on trainluggage left on train

––

Funded by criminal activityFunded by criminal activity

Select Major Terrorist AttacksSelect Major Terrorist Attacks

••

London: 7/07/2005London: 7/07/2005––

HomeHome--grown Algrown Al--Qaeda cellQaeda cell––

Trains / busTrains / bus––

Suicide bombersSuicide bombers––

Self fundedSelf funded

••

Amman: 11/09/05Amman: 11/09/05––

AlAl--Qaeda of IraqQaeda of Iraq––

HotelsHotels––

Suicide bombers / car bombSuicide bombers / car bomb

––

Funded by AlFunded by Al--Qaeda of IraqQaeda of Iraq

Areas of VulnerabilityAreas of Vulnerability

••

For societyFor society––

Terrorists are adept at identifying Terrorists are adept at identifying and exploiting systemic and exploiting systemic weaknessesweaknesses••

Risk recognitionRisk recognition

––

Adaptability factorAdaptability factor

••

For terroristsFor terrorists––

CommunicationsCommunications

––

FinanceFinance

Economic JihadEconomic Jihad

••

Theology of Theology of ““Economic Economic JihadJihad””

–– Terrorist fundraising Terrorist fundraising mechanismmechanism

••

A religious duty to engage A religious duty to engage in Jihadin Jihad

––

If not by physically fighting, If not by physically fighting, then by funding those that then by funding those that dodo

••

QuranicQuranic verse in verse in SurahSurah 9, 9, Verse 41Verse 41

––

““Fight with your possessions Fight with your possessions and your souls in the way of and your souls in the way of AllahAllah””

Understanding and Understanding and DisruptingDisrupting

Terrorist FinancingTerrorist Financing

••

Terrorist financing usually discussed in Terrorist financing usually discussed in generic contextgeneric context––

Seldom understood, often misunderstoodSeldom understood, often misunderstood

––

Must be presented in specific termsMust be presented in specific terms••

Understanding the multiUnderstanding the multi--dimensional dimensional elements of the funding process should take elements of the funding process should take into consideration:into consideration:––

Types of terrorist groupsTypes of terrorist groups

––

Funding capacityFunding capacity––

Mechanisms for fundraising and operationsMechanisms for fundraising and operations

––

Individuals, entities and cellsIndividuals, entities and cells

Understanding and Disrupting Understanding and Disrupting Terrorist FinancingTerrorist Financing

••

FBI assessment issued January 11, 2007, FBI assessment issued January 11, 2007, identified the following groups as threats identified the following groups as threats to the U.S.:to the U.S.:––

Al QaedaAl Qaeda

––

Regional terrorist groups aligned with Al QaedaRegional terrorist groups aligned with Al Qaeda

––

Homegrown cellsHomegrown cells

––

Shia extremistsShia extremists

––

Palestinian terrorist groupsPalestinian terrorist groups

––

Domestic terrorist groupsDomestic terrorist groups

Types of Terrorist GroupsTypes of Terrorist Groups

OCOC--Terrorism NexusTerrorism Nexus

••

Organized crime groups are Organized crime groups are incorporating characteristics incorporating characteristics and methods of operations and methods of operations from terrorist groupsfrom terrorist groups

••

Terrorist groups are Terrorist groups are adopting strategies learned adopting strategies learned from organized crimefrom organized crime

••

This evolution makes both This evolution makes both groups stronger and more groups stronger and more flexible flexible

OC OC –– Terrorism ComparisonTerrorism ComparisonOrganized CrimeOrganized Crime••

Motivated by profit/greedMotivated by profit/greed

••

Seek economic endsSeek economic ends

••

Engage in corruptionEngage in corruption

••

Network and cell based Network and cell based structurestructure

••

Requires safeRequires safe--havenshavens

••

Needs to recruit new membersNeeds to recruit new members

••

Requires specialistsRequires specialists

••

Group identity importantGroup identity important

••

Threat of violenceThreat of violence

••

Select targets that pose threat Select targets that pose threat to the groupto the group

••

Avoid public attentionAvoid public attention

••

Money laundering essential Money laundering essential operating tooloperating tool

Terrorist GroupsTerrorist Groups••

Motivated by ideologyMotivated by ideology

••

Seek political endsSeek political ends

••

Engage in corruptionEngage in corruption

••

Network and cell based Network and cell based structurestructure

••

Requires safeRequires safe--havenshavens

••

Needs to recruit new membersNeeds to recruit new members

••

Requires specialistsRequires specialists

••

Group identity importantGroup identity important

••

Threat of violenceThreat of violence

••

Select symbolic Select symbolic targets targets

••

Seek public attentionSeek public attention

••

Money laundering essential Money laundering essential operating tooloperating tool

Funding Capacity Funding Capacity

••

Terrorist groups require financial Terrorist groups require financial support in order to achieve their support in order to achieve their goalsgoals––

Must have effective financial Must have effective financial infrastructures to includeinfrastructures to include

Sources of fundingSources of funding

Means of laundering fundsMeans of laundering funds

Availability of fundingAvailability of funding

Funding Dimensions Funding Dimensions ••

Two distinct functionsTwo distinct functions––

FundraisingFundraising••

Generally larger dollar amountsGenerally larger dollar amounts

••

Greater degree of money launderingGreater degree of money laundering

––

Financing of operational terrorist activitiesFinancing of operational terrorist activities••

Generally lower dollar amountsGenerally lower dollar amounts

••

Intended to avoid detectionIntended to avoid detection••

Detective and preventative strategies must be Detective and preventative strategies must be modified to specifically focus separately and modified to specifically focus separately and collectively on sources and applications of fundscollectively on sources and applications of funds

••

The manner funds are generated and used varies The manner funds are generated and used varies from organization to organizationfrom organization to organization––

Demographics & logistical considerations Demographics & logistical considerations

Mechanisms for Fundraising and Mechanisms for Fundraising and Operational Funding Flows Operational Funding Flows

••

Primary methods of transferring funds Primary methods of transferring funds by terrorist/criminal groupsby terrorist/criminal groups

––

FormalFormal

••

Movement of funds using commercial Movement of funds using commercial financial institutionsfinancial institutions

––

InformalInformal

••

Movement of funds without using Movement of funds without using financial institutionsfinancial institutions

Individuals, Entities and CellsIndividuals, Entities and Cells••

Individuals engaged in terrorism should not be Individuals engaged in terrorism should not be viewed in the general sense of being viewed in the general sense of being ““terroristterrorist””––

Not one dimensionalNot one dimensional••

Essential to identify individuals according to their Essential to identify individuals according to their specific roles and functionsspecific roles and functions

••

Each type of individual possesses specific and Each type of individual possesses specific and unique funding requirementsunique funding requirements––

Some deal solely with fundraisingSome deal solely with fundraising––

Some deal solely with use of fundsSome deal solely with use of funds––

Some deal with bothSome deal with both••

Cells function in a parallel mannerCells function in a parallel manner

••

Entities are facilitation toolsEntities are facilitation tools––

Money laundering mechanismMoney laundering mechanism

Functional Dimensions of Terrorism Functional Dimensions of Terrorism Requiring Funding StreamsRequiring Funding Streams

••

DonorsDonors

••

FundraisersFundraisers

••

FacilitatorsFacilitators

••

ConduitsConduits

••

RecruitersRecruiters

••

LeadersLeaders••

JihadistsJihadists––

OperativesOperatives

––

MartyrsMartyrs––

Suicide Suicide BombersBombers

Who are you likely to deal with Who are you likely to deal with and in what capacity?and in what capacity?

Operational Funding ContrastsOperational Funding Contrasts

••

Ahmed Ahmed RessamRessam––

MilleniumMillenium bomberbomber

Generated funding through Generated funding through criminal activitycriminal activity

••

ZacariasZacarias MoussaouiMoussaoui

––

Associated with 9/11 Associated with 9/11 attacksattacks

Funded by AlFunded by Al--QaedaQaeda

AbdurahmanAbdurahman Muhammad Muhammad AlamoudiAlamoudi••

Naturalized U.S. citizenNaturalized U.S. citizen

••

President and founder of American President and founder of American Muslim FoundationMuslim Foundation––

Extremely influentialExtremely influential••

Linked to terrorismLinked to terrorism––

HamasHamas––

LibyaLibya••

Arrested at Heathrow Airport with $340,000 Arrested at Heathrow Airport with $340,000 in cashin cash

••

Laundered funds through formal and Laundered funds through formal and informal channelsinformal channels

••

Used front companies and phantom Used front companies and phantom organizationsorganizations

Systemic Weaknesses Systemic Weaknesses Exploited by TerroristsExploited by Terrorists

Select Areas of Systemic Select Areas of Systemic Weakness Exploited by TerroristsWeakness Exploited by Terrorists

••

Identify Identify Theft/FraudTheft/Fraud

••

Shell CompaniesShell Companies••

Off Shore HavensOff Shore Havens

••

Credit CardsCredit Cards••

Stored Value Stored Value CardsCards

••

Criminal ActivityCriminal Activity

••

Illegal Money Illegal Money RemittersRemitters

••

NGONGO’’s / Charitiess / Charities••

InternetInternet

••

CyberfraudCyberfraud••

Informal Value Informal Value Transfer SystemsTransfer Systems

••

Money LaunderingMoney Laundering

••

Rarely the sole objective of a crimeRarely the sole objective of a crime––

Almost always employed as a means to commit Almost always employed as a means to commit other crime, be it financially motivated, to other crime, be it financially motivated, to avoid apprehension or detection, or some other avoid apprehension or detection, or some other reasonreason••

Unique in that it is a component of many types of Unique in that it is a component of many types of crimescrimes

••

Terrorists have directed coTerrorists have directed co--conspirators to conspirators to use their identities to present a false time line use their identities to present a false time line and hide their actual whereaboutsand hide their actual whereabouts

––

MajidMajid KhanKhan ––

Adnan El Shukrijumah Adnan El Shukrijumah

Identity TheftIdentity Theft

Operation SmokescreenOperation Smokescreen

Source : Certified NCDMV Photos

Said Mohammed Said Mohammed HarbHarb A.K.A. A.K.A. HarbHarb Hussein Hussein Mustapha; Mustapha; AhmedalquanAhmedalquan; Ahmed A. Am; Ahmed A. Am

Shell CompaniesShell Companies••

FinCEN guidance on potential money FinCEN guidance on potential money laundering risks related to shell companies laundering risks related to shell companies issued November 9, 2006issued November 9, 2006––

Shell companies have become common tools Shell companies have become common tools for money laundering and other financial for money laundering and other financial crimes crimes

Easy and inexpensiveEasy and inexpensive

––

Ownership and transactional information can Ownership and transactional information can be concealed from regulatory and law be concealed from regulatory and law enforcement authoritiesenforcement authorities

Most states do not require disclosure of ownershipMost states do not require disclosure of ownership

––

Provides an opportunity to move money Provides an opportunity to move money without company owners having to disclose without company owners having to disclose their true identities or the nature or purpose of their true identities or the nature or purpose of transactionstransactions

Offshore BankingOffshore Banking

••

Financial Center located outside of the U.S.Financial Center located outside of the U.S.

••

Also known as Also known as ““tax havenstax havens””

••

Strong bank secrecy lawsStrong bank secrecy laws

••

Weak corporate formulation regulationsWeak corporate formulation regulations

••

No cooperation with foreign inquiriesNo cooperation with foreign inquiries

Offshore BankingOffshore Banking

••

““We handle cash derived from We handle cash derived from anyany activityactivity””

••

““Offers services for concealing assetsOffers services for concealing assets””

••

““Can assist clients in getting their cash Can assist clients in getting their cash into the U.S. banking system, without its into the U.S. banking system, without its source being known to anyone, including source being known to anyone, including the the GovtGovt””

AdvertisementsAdvertisements

Global Financial Network Global Financial Network -- AntiguaAntigua

Credit Cards

••

Extremely vulnerable to Extremely vulnerable to fraudfraud

••

Used extensively by Used extensively by terroriststerrorists

Credit Card Use by TerroristsCredit Card Use by Terrorists

••

Funding MechanismFunding Mechanism––

Credit card fraudCredit card fraud••

Ali al Ali al MarriMarri

••

Ahmed Ahmed RessamRessam

••

Operational MechanismOperational Mechanism––

Support terrorist operational Support terrorist operational activitiesactivities••

Operation SmokescreenOperation Smokescreen

Operation Smokescreen Trial Chart Operation Smokescreen Trial Chart –– Mohammad Mohammad YoussefYoussef HammoudHammoud

Stored Value CardsStored Value Cards

••

Two TypesTwo Types

––

Closed loopClosed loop

––

Open loopOpen loop

••

Growing and evolving marketGrowing and evolving market

••

ReloadableReloadable multimulti--purpose cardspurpose cards

••

Vulnerable to exploitationVulnerable to exploitation––

Ease of useEase of use

––

AnonymityAnonymity

Criminal ActivityCriminal Activity••

Terrorists increasingly rely on criminal Terrorists increasingly rely on criminal activity to raise fundsactivity to raise funds––

Makes them more vulnerableMakes them more vulnerable

••

Fraud investigators should remain vigilant for Fraud investigators should remain vigilant for fraud schemes which could be linked to fraud schemes which could be linked to terrorismterrorism

––

Internet fraudsInternet frauds––

Credit card fraudsCredit card frauds

––

Identity fraudsIdentity frauds––

Bank fraudsBank frauds••

Mortgage fraudsMortgage frauds

––

Drug traffickingDrug trafficking

––

Violent crimesViolent crimes––

Government fraudsGovernment frauds

––

Health care fraudHealth care fraud––

Counterfeit goodsCounterfeit goods

––

Stolen goodsStolen goods––

Insurance fraudInsurance fraud

Illegal Money Remittance BusinessIllegal Money Remittance Business••

Abad Abad ElfgeehElfgeeh––

American citizen born in YemenAmerican citizen born in Yemen••

Carnival French Ice Cream ShopCarnival French Ice Cream Shop––

Annual average revenue about $185,000Annual average revenue about $185,000––

Illegally wired $22 million overseasIllegally wired $22 million overseasMostly to YemenMostly to Yemen

••

Used account with a major bank to Used account with a major bank to wire money overseaswire money overseas

••

Illegally transferred money for Sheik Illegally transferred money for Sheik Mohammed Ali Hassan alMohammed Ali Hassan al--MoayadMoayad––

Al Qaeda and Hamas fundraiser/ Al Qaeda and Hamas fundraiser/ supportersupporter

––

Ties to Osama bin LadenTies to Osama bin Laden••

ElfgeehElfgeeh claimed he was not claimed he was not running unlicensed money running unlicensed money transfer business but providing transfer business but providing a a ““community servicecommunity service””

Use of Charities by TerroristsUse of Charities by Terrorists

••

Unwitting / LegitimateUnwitting / Legitimate

••

Infiltration / CorruptionInfiltration / Corruption

••

Witting / FrontsWitting / Fronts

••

Dual PurposeDual Purpose––

Logistical supportLogistical support

Hamas NGO ModelHamas NGO Model

••

Lack of universal recognition Lack of universal recognition as terrorist organizationas terrorist organization––

Social services networkSocial services network

––

Terrorist networkTerrorist network

••

Significant fundraising Significant fundraising apparatusapparatus

••

Use of social services / charity Use of social services / charity as facilitation / logistical as facilitation / logistical support mechanismssupport mechanisms

Terrorist Exploitation of the Internet Terrorist Exploitation of the Internet

••

Psychological warfarePsychological warfare

••

PropagandaPropaganda––

RecruitmentRecruitment

••

FundraisingFundraising

••

CommunicationsCommunications

••

Information gatheringInformation gathering––

TrainingTraining

CyberfraudCyberfraud

••

Ranging from Credit Card Theft to Money Ranging from Credit Card Theft to Money LaunderingLaundering

––

The The ““new cash cownew cash cow”” for terrorists to finance for terrorists to finance

operationsoperations

••

Imam Imam SamudraSamudra––

Mastermind of Bali bombingMastermind of Bali bombing

––

Attempted to finance bombing through Attempted to finance bombing through cyberfraudcyberfraud

––

Wrote jailhouse manifesto, Wrote jailhouse manifesto, ““Hacking, Why Hacking, Why NotNot””

Online credit card fraud and money Online credit card fraud and money launderinglaundering

Alternate Value Transfer SystemAlternate Value Transfer System••

Informal system for money payments Informal system for money payments within a country or internationallywithin a country or internationally

••

General definition of transfer or delivery of General definition of transfer or delivery of value based on trustvalue based on trust

••

Has been in existence for centuriesHas been in existence for centuries

••

Known by many namesKnown by many names

––

HawalaHawala

––

HundiHundi

––

Underground banking systemUnderground banking system

––

Black market currency exchangesBlack market currency exchanges

No Legal Records, No Tracking Mechanisms,No Legal Records, No Tracking Mechanisms,

Popular with Middle Eastern Countries, Viewed as Popular with Middle Eastern Countries, Viewed as LegitimateLegitimate

Hawala DealerHawala Dealer

Cash / CurrencyCash / Currency

UAE, Pakistan, UAE, Pakistan, Saudi Arabia, etcSaudi Arabia, etc

Remitter / SenderRemitter / Sender

Telephone call, Fax, Telephone call, Fax, or Email.or Email.

Code, Chit, or IdentifierCode, Chit, or Identifier

Hawala DealerHawala Dealer

Cash / CurrencyCash / Currency

United States, United States, EuropeEurope

Remitter / SenderRemitter / Sender

Alternate Remittance SystemsAlternate Remittance SystemsMoney MovementMoney Movement

Hawala IndicatorsHawala Indicators••

Indicators of hawala activity are Indicators of hawala activity are identifiable in hawala bank accountsidentifiable in hawala bank accounts––

Significant deposit activitySignificant deposit activity

CashCashChecksChecks

From ethnic communitiesFrom ethnic communitiesMade out to the account holder or secondary entityMade out to the account holder or secondary entityMay have notationMay have notationOften in even dollar amountsOften in even dollar amounts

−− Outgoing transfers (usually by wire) to major Outgoing transfers (usually by wire) to major financial centers known to be involved in financial centers known to be involved in hawalahawala

United KingdomUnited KingdomSwitzerlandSwitzerlandDubaiDubai

••

Import / exportImport / export••

Travel & related servicesTravel & related services

••

Jewelry (gold, precious gems)Jewelry (gold, precious gems)••

Foreign exchangeForeign exchange

••

Rugs / carpetsRugs / carpets••

Used carsUsed cars

••

Car rentals (usually not chain or franchise)Car rentals (usually not chain or franchise)••

Telephone / pagersTelephone / pagers

••

Ethnic grocery storesEthnic grocery stores

Businesses Associated with Businesses Associated with Hawala ActivityHawala Activity

Money LaunderingMoney Laundering

••

Three elements are needed for money Three elements are needed for money laundering:laundering:

––

PlacementPlacement

––

LayeringLayering

––

IntegrationIntegration

Operation Smokescreen Operation Smokescreen -- Proceeds Proceeds from Smuggling Operationfrom Smuggling Operation

••

Proceeds were used Proceeds were used for the following:for the following:

––

Purchase real estatePurchase real estate

––

Purchase vehiclesPurchase vehicles

––

Investment accountsInvestment accounts

––

Money sent to Money sent to LebanonLebanon

––

Money provided to Money provided to HizballahHizballah

Illegitimate Funding

Money LaunderingMoney Laundering

Funds deposited into financial systemFunds deposited into financial system

PlacementPlacement

Legitimate Funding or

Illegitimate Funding

Terrorist FinancingTerrorist FinancingThe ProcessThe Process

Funds moved to other institutions to obscure origin

LayeringLayering

IntegrationIntegrationFunds used to acquire

legitimate assetsFunds distributed to finance

terrorist activities

Money Laundering and Terrorism Money Laundering and Terrorism Finance ComparisonFinance ComparisonMoney LaunderingMoney Laundering••

Motivation is profitMotivation is profit

••

Circular funding flowCircular funding flow––

Vlademiro MontesinosVlademiro Montesinos••

PEPPEP––

Abused his trustAbused his trust

••

Laundered over 400 Laundered over 400 million globally million globally (80 million in U.S.)(80 million in U.S.)

••

SARs instrumental to SARs instrumental to investigationinvestigation

Terrorism FinanceTerrorism Finance••

Motivation is ideologicalMotivation is ideological

••

Linear funding flowLinear funding flow––

Shawqi OmarShawqi Omar••

TerroristTerrorist

––

Abu Musab alAbu Musab al--ZarqawiZarqawi

••

Beneficiary of multiple Beneficiary of multiple frauds involving family frauds involving family members in U.S.members in U.S.

••

SARs instrumental to SARs instrumental to investigationinvestigation

Money Laundering RisksMoney Laundering Risks••

GeographyGeography––

State sponsorsState sponsors––

Secrecy jurisdictions / tax havensSecrecy jurisdictions / tax havens––

CorruptionCorruption––

NonNon--cooperative jurisdictions as defined by FinCEN / cooperative jurisdictions as defined by FinCEN / FATFFATF

••

BusinessBusiness––

NBFINBFI’’ss (currency exchange houses, money transmitters)(currency exchange houses, money transmitters)––

Travel agenciesTravel agencies––

Import / export and trading companiesImport / export and trading companies

••

Financial ServicesFinancial Services––

Private bankingPrivate banking––

Private investment companiesPrivate investment companies––

International correspondent banking activityInternational correspondent banking activity––

Transactions involving a financial intermediary where Transactions involving a financial intermediary where the primary beneficiary or counterparty is undisclosedthe primary beneficiary or counterparty is undisclosed

Money Laundering MechanismsMoney Laundering Mechanisms

••

Businesses (witting/unwitting culpability)Businesses (witting/unwitting culpability)––

Front companiesFront companies••

Mostly legitimateMostly legitimate

••

CashCash--based operating companiesbased operating companies––

Shell companiesShell companies••

Exist only on paperExist only on paper

••

Ensure anonymityEnsure anonymity••

FastFast

••

NonNon--government organizationsgovernment organizations••

(witting/unwitting culpability)(witting/unwitting culpability)––

CharitiesCharities••

LegitimateLegitimate

••

CorruptedCorrupted––

Terrorist Financing vehicleTerrorist Financing vehicle

CharacteristicsCharacteristics andand

TrendsTrends

Changing DynamicsChanging Dynamics••

Depletion of AlDepletion of Al--QaedaQaeda

–– Since September 11, 2001, thousands of AlSince September 11, 2001, thousands of Al--Qaeda Qaeda leaders and foot soldiers have been killed or taken into leaders and foot soldiers have been killed or taken into custody around the globecustody around the globe

••

Evolution of regional networksEvolution of regional networks––

Loosely connectedLoosely connected––

More autonomousMore autonomous––

ResilientResilient

••

A significant threat posed by AlA significant threat posed by Al--Qaeda lies in its Qaeda lies in its ability to inspire other groups to commit terrorist ability to inspire other groups to commit terrorist actsacts

••

Reconstitution of AlReconstitution of Al--QaedaQaeda

Dynamics of ChangeDynamics of Change

••

Terrorist / terrorist financing Terrorist / terrorist financing characteristics constantly evolve due characteristics constantly evolve due to changing dynamics in world to changing dynamics in world eventsevents

––

Global response to terrorismGlobal response to terrorism

––

Ability of terrorists to adapt to changing Ability of terrorists to adapt to changing dynamics to avoid detectiondynamics to avoid detection

••

Characteristics and warning signs Characteristics and warning signs should be considered should be considered nonnon--staticstatic

Ali al Ali al MarriMarri

••

AlAl--Qaeda Facilitator for Qaeda Facilitator for PostPost--9/11 Activity in 9/11 Activity in United StatesUnited States––

Arrested with multiple Arrested with multiple fictitious credit cardsfictitious credit cards

––

Internet expertInternet expert

••

Entered U.S. on 9/10 as Entered U.S. on 9/10 as college student traveling college student traveling with wife and daughterwith wife and daughter

••

More identifiable with More identifiable with Western societyWestern society

New Generation of TerroristsNew Generation of Terrorists••

Better educatedBetter educated

•• Less experiencedLess experienced

•• More radicalMore radical

•• AutonomousAutonomous

•• More engaged in More engaged in criminal activitiescriminal activities

•• Increased use of false Increased use of false identificationidentification

•• Internet exploitationInternet exploitation

•• ResilientResilient

Generation JihadGeneration Jihad

••

Loose homeLoose home--grown youth networksgrown youth networks––

Some exist only in cyberspaceSome exist only in cyberspace

••

Inspired by AlInspired by Al--QaedaQaeda––

Not formal membersNot formal members

••

Encompass a variety of ethnic Encompass a variety of ethnic backgroundsbackgrounds––

Includes Middle Easterners, Africans, Includes Middle Easterners, Africans, South Asians, and converts to IslamSouth Asians, and converts to Islam

••

Operate locally and autonomouslyOperate locally and autonomously––

Venues include Europe, United States, Venues include Europe, United States, Australia, CanadaAustralia, Canada

Warning SignsWarning Signs / Countermeasures/ Countermeasures••

UnderstandUnderstand––

Terrorist / terrorist financing risk Terrorist / terrorist financing risk factorsfactors

––

Money laundering risk factorsMoney laundering risk factors––

Systemic vulnerabilitiesSystemic vulnerabilities

––

Institutional vulnerabilitiesInstitutional vulnerabilities

••

Develop risk / vulnerability matricesDevelop risk / vulnerability matrices••

Identify countermeasures and Identify countermeasures and control mechanismscontrol mechanisms

••

Be vigilantBe vigilant

Case StudyCase Study

Utah Mortgage Fraud CaseUtah Mortgage Fraud Caseand/orand/or

Material Support to TerrorismMaterial Support to Terrorism

? ? ?? ? ?

A Utah Link to Terrorism?A Utah Link to Terrorism? (Salt Lake Tribune 4/26/2006)(Salt Lake Tribune 4/26/2006)

••

Omar familyOmar family••

Investigative chronologyInvestigative chronology

••

Multiple fraud schemesMultiple fraud schemes••

Business frontsBusiness fronts––

Shell company (importShell company (import--export)export)––

Fictitious company (construction)Fictitious company (construction)––

Front company (trading)Front company (trading)••

Data mining SARsData mining SARs

••

Proactive banking assistanceProactive banking assistance••

Formal & informal financial systemsFormal & informal financial systems––

Money launderingMoney laundering––

Cash couriersCash couriers••

Terrorism nexusTerrorism nexus

Investigative ChronologyInvestigative Chronology••

August 2002August 2002 Initiate Preliminary Inquiry (PI)Initiate Preliminary Inquiry (PI)

••

February 2003February 2003 PI closedPI closed••

May 2003May 2003 Initiate Financial Institution Fraud Initiate Financial Institution Fraud

(FIF) investigation(FIF) investigation••

December 2003December 2003 FIF case declined for prosecutionFIF case declined for prosecution

••

October 2004October 2004 ShawkiShawki Omar captured in IraqOmar captured in IraqIdentified as lieutenant of Abu Identified as lieutenant of Abu MussabMussab al al ZarqawiZarqawi

••

February 2005February 2005 Initiate investigationInitiate investigationOmar definitively linked to U.S. based individualsOmar definitively linked to U.S. based individualsFocus to determine U.S. based terrorist activityFocus to determine U.S. based terrorist activityInformation from previous FIF case reInformation from previous FIF case re--examinedexaminedFraud investigation expandsFraud investigation expands

–– Numerous SARs identifiedNumerous SARs identified

••

Feb/July 2006Feb/July 2006 Criminal IndictmentsCriminal Indictments••

April 2006April 2006 ArrestsArrests

••

Sept/Oct 2006Sept/Oct 2006 Initial prosecutionsInitial prosecutionsThree subjects convictedThree subjects convicted

••

Investigation / Legal process ongoingInvestigation / Legal process ongoing

Case SummaryCase Summary•

Criminal enterprise led by Alaa Ramadan, aka Alex Ramadan

•

Members of the criminal enterprise included members of the Ramadan, Omar, and Abudan families

•

Palestinians/ mostly Jordanian Nationals

•

Operated in Utah prior to 2000 and at least until 2003

••

Criminal enterprise led by Criminal enterprise led by AlaaAlaa Ramadan, aka Alex Ramadan, aka Alex RamadanRamadan

••

Members of the criminal Members of the criminal enterprise included members enterprise included members of the Ramadan, Omar, and of the Ramadan, Omar, and AbudanAbudan families families

••

Palestinians/ mostly Palestinians/ mostly Jordanian NationalsJordanian Nationals

••

Operated in Utah prior to Operated in Utah prior to 2000 and at least until 20032000 and at least until 2003

••

Group members perpetrated extensive fraudulent Group members perpetrated extensive fraudulent activity to include: mortgage fraud, loan fraud, activity to include: mortgage fraud, loan fraud, credit card fraud, insurance fraud, fraud against credit card fraud, insurance fraud, fraud against individuals and identity theft/falsification.individuals and identity theft/falsification.

••

Criminal proceeds exceeded 2 million dollarsCriminal proceeds exceeded 2 million dollars––

Amount identified via investigationAmount identified via investigation––

Additional criminal activity/proceeds suspectedAdditional criminal activity/proceeds suspected

••

Funds from fraud schemes sent overseasFunds from fraud schemes sent overseas••

Family members sent money to terrorist Family members sent money to terrorist ((ShawqiShawqi Omar) in IraqOmar) in Iraq

••

Criminal chargesCriminal charges••

No terrorism charges to dateNo terrorism charges to date

Case Summary ContinuedCase Summary Continued

The TerroristThe TerroristShawkiShawki Omar, aka Abu Ahmed AlOmar, aka Abu Ahmed Al--AmrikiAmriki

••

Naturalized U.S. Citizen, resided in Utah, Naturalized U.S. Citizen, resided in Utah, North Carolina, and other statesNorth Carolina, and other states

••

At one point a member of Minnesota At one point a member of Minnesota National GuardNational Guard

••

Furniture Import business associated with Furniture Import business associated with SyriaSyria

••

Jordan, UAE, IraqJordan, UAE, Iraq

ShawkiShawki OmarOmar

•

Indicted as participant in Jordan Terror Plot April 2004

•

Captured in Iraq October 2004•

Associated with Abu Musab Al-Zarqawi

•

Also associated with Abu Muhammad Al- Maqdesi (spiritual advisor to Zarqawi)

•

Leader, recruiter, financer •

Enemy Combatant

••

Indicted as participant Indicted as participant in Jordan Terror Plot in Jordan Terror Plot April 2004April 2004

••

Captured in Iraq October 2004Captured in Iraq October 2004••

Associated with Abu Musab AlAssociated with Abu Musab Al--ZarqawiZarqawi

••

Also associated with Abu Muhammad AlAlso associated with Abu Muhammad Al-- MaqdesiMaqdesi (spiritual advisor to Zarqawi)(spiritual advisor to Zarqawi)

••

Leader, recruiter, financer Leader, recruiter, financer ••

Enemy Combatant Enemy Combatant

The FamilyThe Family

The FraudsThe Frauds•

Mortgage fraud–

Straw buyer

–

Buy for inflated amount–

Divert profit to shell or front company

–

Straw buyer cannot make payment–

Foreclosure

•

Loan fraud–

Example: two car loans on same vehicle

•

Credit card fraud, insurance fraud, identity theft/fraud, etc.

••

Mortgage fraudMortgage fraud––

Straw buyerStraw buyer

––

Buy for inflated amountBuy for inflated amount––

Divert profit to shell or front companyDivert profit to shell or front company

––

Straw buyer cannot make paymentStraw buyer cannot make payment––

ForeclosureForeclosure

••

Loan fraudLoan fraud––

Example: two car loans on same Example: two car loans on same vehiclevehicle

••

Credit card fraud, insurance fraud, Credit card fraud, insurance fraud, identity theft/fraud, etc.identity theft/fraud, etc.

••

Family members used to move moneyFamily members used to move money••

Funds transferred among multiple bank Funds transferred among multiple bank accounts accounts

••

Funds sent overseasFunds sent overseas••

Front companies/shell companiesFront companies/shell companies

••

More than 50 bank accounts More than 50 bank accounts ••

ATM card withdrawals to include overseas ATM card withdrawals to include overseas

••

Proxies/straw buyersProxies/straw buyers••

Lying/selective memory loss by family membersLying/selective memory loss by family members

••

Import/Export businessImport/Export business••

Car dealershipsCar dealerships

Techniques That Made Detection Techniques That Made Detection DifficultDifficult

Law Enforcement Techniques That Law Enforcement Techniques That Assisted This InvestigationAssisted This Investigation

•

SARS•

Use of Grand Jury Subpoenas – not National Security Letters

•

Task Force–

Federal, state and local law enforcement coordination

•

Various checks conducted by CIA and the Terrorist Financing Operations Section

•

Coordination with financial institutions

••

SARSSARS••

Use of Grand Jury Subpoenas Use of Grand Jury Subpoenas –– not not National Security LettersNational Security Letters

••

Task ForceTask Force––

Federal, state and local law enforcement Federal, state and local law enforcement coordinationcoordination

••

Various checks conducted by CIA and Various checks conducted by CIA and the Terrorist Financing Operations the Terrorist Financing Operations SectionSection

••

Coordination with financial institutionsCoordination with financial institutions

••

SARsSARs––

SAR Data MiningSAR Data Mining••

FBI Investigative Data WarehouseFBI Investigative Data Warehouse••

Grand Jury SubpoenasGrand Jury Subpoenas

••

National Security LettersNational Security Letters••

Assistance from financial institutionsAssistance from financial institutions

••

Task ForcesTask Forces––

Joint Terrorism Task ForceJoint Terrorism Task Force––

Agency/case specific task forceAgency/case specific task force••

Interagency and intelligence coordinationInteragency and intelligence coordination––

Terrorist Financing Operations SectionTerrorist Financing Operations Section••

Coordination with Foreign GovernmentsCoordination with Foreign Governments––

Legal attachesLegal attaches––

Mutual Legal Assistance TreatyMutual Legal Assistance Treaty••

Proactive investigative techniquesProactive investigative techniques––

Undercover operationsUndercover operations––

Wire taps Wire taps

Law Enforcement Techniques Law Enforcement Techniques That Facilitate DetectionThat Facilitate Detection

ConvictionsConvictions••

Rebecca BensonRebecca Benson––

In June and September 2006, Rebecca Benson pled In June and September 2006, Rebecca Benson pled guilty to 2 felony counts of Bank Fraud and False guilty to 2 felony counts of Bank Fraud and False Statements on a Loan Application.Statements on a Loan Application.

––

Cooperated, and was sentenced to probationCooperated, and was sentenced to probation

••

AlaaAlaa RamadanRamadan––

On October 19, 2006, On October 19, 2006, AlaaAlaa Ramadan pled guilty to 24 Ramadan pled guilty to 24 felony counts including Bank Fraud, Wire and Mail Fraud, felony counts including Bank Fraud, Wire and Mail Fraud, Money Laundering and Tax charges.Money Laundering and Tax charges.

––

Sentenced to 41 months, followed by deportationSentenced to 41 months, followed by deportation

••

James GibbonsJames Gibbons––

On October 25, 2006, James Gibbons pled guilty to 3 On October 25, 2006, James Gibbons pled guilty to 3 felony counts including Mail Fraud and Money felony counts including Mail Fraud and Money Laundering.Laundering.

––

Sentenced to 24 monthsSentenced to 24 months

Pending Trials of Pending Trials of SharifSharif Omar, Omar, BassamBassam Omar and Ahmed Omar and Ahmed AbudanAbudan

Hot WashHot Wash••

How schemes detected by law How schemes detected by law enforcementenforcement––

Initial complaints re: fraudulent activity Initial complaints re: fraudulent activity received by citizens in 2001received by citizens in 2001

––

Grand Jury subpoenas identified bank accountsGrand Jury subpoenas identified bank accounts––

““Following the moneyFollowing the money”” identified additional identified additional subjects and accountssubjects and accounts

––

SARs were examined leading to the SARs were examined leading to the identification of additional subjects, accounts, identification of additional subjects, accounts, and money laundering methodsand money laundering methods

––

One SAR so specific led to indictment on fraudOne SAR so specific led to indictment on fraud––

Media coverage caused several financial Media coverage caused several financial institutions to run name checks and conduct institutions to run name checks and conduct subsequent investigation which identified bank subsequent investigation which identified bank accounts triggering SAR submissions and direct accounts triggering SAR submissions and direct notificationnotification

••

Events triggering SAR filings by financial Events triggering SAR filings by financial institutionsinstitutions––

ForeclosuresForeclosures––

Due diligence background checksDue diligence background checks••

Individuals with multiple mortgagesIndividuals with multiple mortgages

––

Two car loans on same vehicleTwo car loans on same vehicle––

Unreasonable deposit patternsUnreasonable deposit patterns••

Multiple deposits in nonMultiple deposits in non--business account by different business account by different individualsindividuals

––

Same individual opening accounts for no valid reasonSame individual opening accounts for no valid reason––

Accounts opened for short periods of timeAccounts opened for short periods of time••

Minimal transaction activityMinimal transaction activity

––

Large monetary transfers to at risk countriesLarge monetary transfers to at risk countries––

Overseas ATM withdrawalsOverseas ATM withdrawals––

Media coverage causing name checks and subsequent Media coverage causing name checks and subsequent investigationinvestigation

Hot WashHot Wash

••

Final assessmentFinal assessment––

SARs contained significant information, which SARs contained significant information, which over time, led to development of evidence over time, led to development of evidence necessary to sustain prosecutionnecessary to sustain prosecution••

SARs became more meaningful as investigation SARs became more meaningful as investigation progressedprogressed

••

Until sufficient investigation conducted true Until sufficient investigation conducted true importance of information not fully understoodimportance of information not fully understood

––

Time consuming investigative processTime consuming investigative process••

““Treasure troveTreasure trove”” only became apparent after months only became apparent after months of diligent investigation of diligent investigation

––

Importance of vigilance by financial Importance of vigilance by financial institutionsinstitutions••

Discovery of suspicious activityDiscovery of suspicious activity

••

Follow up with law enforcementFollow up with law enforcement––

Importance of cooperation and communicationImportance of cooperation and communication

Hot WashHot Wash

Material Support???Material Support???

ConclusionConclusion

Best Practices for AML / Terrorist Best Practices for AML / Terrorist Financing Detection & PreventionFinancing Detection & Prevention••

Risk Assessment Risk Assessment ProcessProcess––

AdaptabilityAdaptability

••

Know Your Customer Know Your Customer PracticesPractices––

Area of detectionArea of detection

••

Suspicious Activity Suspicious Activity ReportingReporting––

ComprehensivenessComprehensiveness––

Data mining initiativesData mining initiatives

••

TrainingTraining––

Terrorist financing Terrorist financing specificspecific

Economic JihadEconomic Jihad••

Financial institution Financial institution employees are on the employees are on the front line of the war on front line of the war on terrorismterrorism

––

Financial componentFinancial component

••

You may never encounter You may never encounter a terrorist or a terrorist a terrorist or a terrorist supportersupporter

••

HOWEVERHOWEVER……you mayyou may

Corporate HeadquartersCorporate Headquarters 11440 Commerce Park Drive, Suite 50111440 Commerce Park Drive, Suite 501

Reston, VA 20191Reston, VA 20191 703.860.0190/703.860.0436 (fax)703.860.0190/703.860.0436 (fax)

www.corprisk.comwww.corprisk.comDennis M. LormelDennis M. Lormel

Senior Vice PresidentSenior Vice Presidentdennis.lormel@corprisk.comdennis.lormel@corprisk.com

Gregory T. BretzingGregory T. BretzingSupervisory Special AgentSupervisory Special Agent

Federal Bureau of InvestigationFederal Bureau of InvestigationSalt Lake DivisionSalt Lake Division

801801--579579--44204420gbretzing@leo.govgbretzing@leo.gov

Corporate Risk International